CVE-2026-48172: LiteSpeed cPanel Plugin Privilege Escalation Vulnerability
LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.
Other sources
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpaneljsonapifunc=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LiteSpeed WHM PlugInto a version that resolves this vulnerability.Fixed in 5.3.1.0 - Upgrade
Upgrade
LiteSpeed User-End cPanel Pluginto a version that resolves this vulnerability.Fixed in 2.4.7 - Compensating control
Run the detection command: grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null (in Bash). If output is present, examine the IP addresses in the list, validate whether they are valid IP addresses, and block them.
- Operational
If detection returns output, examine the system logs for use by the detected IP addresses to determine what damage/exploitation may have occurred.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48172?
CVE-2026-48172 is classified as a high-severity vulnerability due to its potential for privilege escalation.
How can I fix CVE-2026-48172?
To fix CVE-2026-48172, upgrade the LiteSpeed User-End cPanel Plugin to version 2.4.5 or later.
Who is affected by CVE-2026-48172?
CVE-2026-48172 affects users of LiteSpeed User-End cPanel Plugin versions prior to 2.4.5.
What is the impact of CVE-2026-48172?
The impact of CVE-2026-48172 includes potential privilege escalation, which could allow malicious users to gain unauthorized access.
When was CVE-2026-48172 exploited in the wild?
CVE-2026-48172 was reported to be exploited in the wild in May 2026.